The numbers

Every threshold that changes what you have to do, in one place, with the provision that sets it. Facts you could look up yourself — collected so you do not have to.

Who the rule reaches, and how much of it#

Number	What it decides	Authority
Fewer than 5,000 consumers	Four requirements do not apply: the written risk assessment, the testing regime (continuous monitoring, or annual penetration testing plus semiannual vulnerability scans), the written incident response plan, and the annual written report. Everything else still applies. The duty to assess risk is not excused — only the duty to put the assessment in writing.	16 CFR § 314.6 excepting §§ 314.4(b)(1), (d)(2), (h), (i)
500 or more consumers	A “notification event” requiring a report to the FTC within 30 days of discovery — but only for unencrypted customer information. Counted nationwide.	16 CFR § 314.4(j)
500 or more Florida residents	Notice to the Florida Department of Legal Affairs within 30 days. Counted against Florida residents only.	Fla. Stat. § 501.171(3)(a)
More than 1,000 individuals	Notice to the nationwide consumer reporting agencies. Note the comparator: more than, not or more. At exactly 1,000 this does not trigger.	Fla. Stat. § 501.171(5)
Two years	The outer limit for holding customer information: dispose of it no later than two years after the last date it was used. This is a ceiling on holding data, not a floor on keeping records. The Safeguards Rule sets no retention period at all.	16 CFR § 314.4(c)(6)
10 days	A third-party agent must notify the covered entity of a breach within ten days.	Fla. Stat. § 501.171(6)

The counting question nobody has answered. The 5,000 threshold counts consumers. Do dependents listed on a joint return count? Do the employees of a payroll client count? The FTC has published no counting method, and we are not going to pretend otherwise on this page. The arithmetic moves fast either way: a practice filing 300 individual returns can be looking at roughly 1,200 consumers, and the 5,000 line tends to bite somewhere around 900 to 1,300 returns. A payroll book of 130 clients at 40 employees each is 5,200 people before you count anyone else.

The book takes the conservative reading and says openly that it is a reading. If the answer changes what you have to do, it is a question for a GLBA attorney — and the fact that you are near the line is itself worth knowing.

Passwords and authentication#

NIST SP 800‑63B Revision 4, § 3.1.1.2. Revision 4 was published final July 31, 2025 and supersedes Revision 3.
Number	What it decides
15 characters	Minimum length for a password used as a single factor. This is a shall.
8 characters	Minimum length for a password used only as part of multi-factor authentication.
64 characters	The maximum length verifiers should permit, at least. Long passphrases must be allowed to be long.
Zero	Composition rules — forced mixes of uppercase, digits, and symbols. Verifiers shall not impose them. Under Revision 3 this was a should not; Revision 4 hardened it.
Never	Periodic forced password changes. Verifiers shall not require them. Change is forced on evidence of compromise, and not on a calendar.

A conflict worth understanding rather than ignoring. IRS Publication 4557 (Rev. 6‑2024) recommends eight-character passwords and describes eight characters as “the NIST standard.” That was accurate under Revision 3. It is not accurate now.

The publication is current and worth reading; one claim inside it is stale. That distinction matters, because “IRS guidance is outdated, disregard it” is bad advice for a tax professional. Meet the higher standard and you have met both.

Penalties#

Number	What it is	Authority
$1,000 up to $100,000 in some cases	Criminal fine for a preparer who knowingly or recklessly discloses or misuses return information — plus up to one year of imprisonment and costs of prosecution. This is personal criminal exposure, not a firm-level civil penalty.	26 U.S.C. § 7216 $100,000 where § 6713(b) applies
$500,000 per breach	Cap on Florida civil penalties for notice violations: $1,000 per day for the first 30 days, then $50,000 per 30‑day period through 180 days.	Fla. Stat. § 501.171(9)
1 to 2 years	Typical suspension from IRS e‑file for a Level Two infraction — one with adverse impact. Level Three can mean up to two years or expulsion.	IRS Pub 3112 Rev. Proc. 2007‑40 § 7

Every authority on this page is listed, linked, and dated on the source status page. Numbers change; that page is where you find out whether these still hold.

The reporting deadlines Does this apply to me?